• Ben Gardon's avatar
    Revert "KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range()" · 92da008f
    Ben Gardon authored
    This reverts commit 71883a62.
    
    The above commit contains an optimization to kvm_zap_gfn_range which
    uses gfn-limited TLB flushes, if enabled. If using these limited flushes,
    kvm_zap_gfn_range passes lock_flush_tlb=false to slot_handle_level_range
    which creates a race when the function unlocks to call cond_resched.
    See an example of this race below:
    
    CPU 0                   CPU 1                           CPU 3
    // zap_direct_gfn_range
    mmu_lock()
    // *ptep == pte_1
    *ptep = 0
    if (lock_flush_tlb)
            flush_tlbs()
    mmu_unlock()
                            // In invalidate range
                            // MMU notifier
                            mmu_lock()
                            if (pte != 0)
                                    *ptep = 0
                                    flush = true
                            if (flush)
                                    flush_remote_tlbs()
                            mmu_unlock()
                            return
                            // Host MM reallocates
                            // page previously
                            // backing guest memory.
                                                            // Guest accesses
                                                            // invalid page
                                                            // through pte_1
                                                            // in its TLB!!
    
    Tested: Ran all kvm-unit-tests on a Intel Haswell machine with and
    	without this patch. The patch introduced no new failures.
    Signed-off-by: default avatarBen Gardon <bgardon@google.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    92da008f
mmu.c 157 KB